NetSight
IP …
critical9.8

CVE-2017-5645

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially …

Impact

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected products

VendorProductAffected versions
ApacheLog4j
from 2.0 before 2.8.2
NetappOncommand Api Services
All versions
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
NetappService Level Manager
All versions
NetappSnapcenter
All versions
NetappStorage Automation Store
All versions
RedhatFuse
Version 1.0
RedhatEnterprise Linux
Versions 6.0, 6.7, 7.0, 7.3, 7.4, 7.5
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 7.6

Weakness classification

CWE-502

References